Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2019-11280
PUBLISHED
More InfoOfficial Page
Assigner-pivotal
Assigner Org ID-862b2186-222f-48b9-af87-f1fb7bb26d03
View Known Exploited Vulnerability (KEV) details
Published At-20 Sep, 2019 | 18:35
Updated At-16 Sep, 2024 | 19:20
Rejected At-
▼CVE Numbering Authority (CNA)
Privilege escalation through the invitations service

Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.

Affected Products
Vendor
VMware (Broadcom Inc.)Pivotal
Product
Pivotal Application Service (PAS)
Versions
Affected
  • 2.3.x prior to 2.3.18
  • 2.4.x prior to 2.4.14
  • 2.5.x prior to 2.5.10
  • 2.6.x prior to 2.6.5
Problem Types
TypeCWE IDDescription
CWECWE-269CWE-269: Improper Privilege Management
Metrics
VersionBase scoreBase severityVector
3.08.8HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://pivotal.io/security/cve-2019-11280
x_refsource_CONFIRM
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://pivotal.io/security/cve-2019-11280
x_refsource_CONFIRM
x_transferred
Details not found